Code

Integrate threat intel feeds#669

Code

Merged

amsiglan merged 39 commits intomainopensearch-project/security-analytics:mainfrom feature/threat_intel_feedsopensearch-project/security-analytics:feature/threat_intel_feedsCopy head branch name to clipboardOct 25, 2023

+6,047-415

Commits

Commits on Oct 16, 2023

• add mapping for indices storing threat intel feed data

  Show description for 12dd633
  eirsep

  committed
  12dd633

• fix feed indices mapping

  Show description for a0fd6bd
  eirsep

  committed
  a0fd6bd

• add threat intel feed data dao

  Show description for d7ee565
  eirsep

  committed
  d7ee565

• add threatIntelEnabled field in detector.

  Show description for 57c0faa
  eirsep

  committed
  57c0faa

• add threat intel feed service and searching feeds

  Show description for f0a8bed
  eirsep

  committed
  f0a8bed

• ti feed data to doc level query convertor logic added

  Show description for 4594926
  eirsep

  committed
  4594926

• plug threat intel feed into detector creation

  Show description for f7ff940
  eirsep

  committed
  f7ff940

• Preliminary framework for jobscheduler and datasource (#626)

  Show description for c193773
  

  jowg-amazon

  authored and

  eirsep

  committed
  c193773

• create doc level query from threat intel feed data index docs"

  Show description for 2e52a02
  eirsep

  committed
  2e52a02

• handle threat intel enabled check during detector updation

  Show description for 1830ec9
  eirsep

  committed
  1830ec9

• add tests for testing threat intel feed integration with detectors

  Show description for dababa8
  eirsep

  committed
  dababa8

• Threat intel feeds job runner and unit tests (#654)

  Show description for 5c733ed
  

  jowg-amazon

  and

  eirsep

  committed
  5c733ed

• converge job scheduler code with threat intel feed integration in detectors

  Show description for 4512308
  eirsep

  committed
  4512308

• converge job scheduler and detector threat intel code

  Show description for d1d7ca0
  eirsep

  committed
  d1d7ca0

• add feed metadata config files in src and test

  Show description for d53085b
  eirsep

  committed
  d53085b

• adds ioc fields list in log type config files and ioc fields object in LogType POJO

  Show description for 98bbd42
  eirsep

  committed
  98bbd42

• fix compilation issues in tests

  Show description for decee51
  eirsep

  committed
  decee51

Commits on Oct 17, 2023

• test udpate detector disabling threat intel

  Show description for a79b8ac
  eirsep

  committed
  a79b8ac

• add tests for detector creation and updation with threat intel

  Show description for 2b59191
  eirsep

  committed
  2b59191

• Threat intel test (#673)

  Show description for f0f8270
  

  eirsep

  and

  jowg-amazon

  authored
  f0f8270

• fix threat intel integ tests and add update detector logic

  Show description for 0bdd58b
  eirsep

  committed
  0bdd58b

Commits on Oct 19, 2023

• JS for Threat intel feeds - changed extension (#675)

  Show description for 0e89286
  

  jowg-amazon

  and

  eirsep

  authored
  0e89286

Commits on Oct 20, 2023

• TIF Job Runner Cleanup (#676)

  Show description for 730b458
  

  jowg-amazon

  and

  eirsep

  authored
  730b458

• fix TIFJobParameter class

  Show description for 7a24bd0
  eirsep

  committed
  7a24bd0

• test detector updation when feed updation job runs

  Show description for 74a7440
  eirsep

  committed
  74a7440

• removed delete job scheduler code and cleaned up (#678)

  Show description for 4dd4190
  jowg-amazon

  authored
  4dd4190

• working integ test (#680)

  Show description for a5136bf
  jowg-amazon

  authored
  a5136bf

Commits on Oct 21, 2023

• fix timeout of tif job creation

  Show description for 24a7e51
  eirsep

  committed
  24a7e51

Commits on Oct 22, 2023

• remove unncessary thread forking in put tif job action

  Show description for 31eebcb
  eirsep

  committed
  31eebcb

• refactoring code to address review comments

  Show description for ae084e7
  eirsep

  committed
  ae084e7

• detector trigger detection types

  Show description for 28f3ba8
  eirsep

  committed
  28f3ba8

• pull out threat intel rest tests into separate test class

  Show description for 2481466
  eirsep

  committed
  2481466

• add detection types testing in detector trigger for rules and threat intel detection scenarios

  Show description for f2068f1
  eirsep

  committed
  f2068f1

Commits on Oct 23, 2023

• add license header

  Show description for 7225ee6
  eirsep

  committed
  7225ee6

• add threat intel field aliases in mapping view response

  Show description for ae666de
  eirsep

  committed
  ae666de

Commits on Oct 25, 2023

• fix threat intel feed parser

  Show description for 040556c
  eirsep

  committed
  040556c

• fix workflow failing test

  Show description for e850248
  eirsep

  committed
  e850248

• spotless check failures fixed

  Show description for 2e88825
  eirsep

  committed
  2e88825

• remove dockerfile (#689)

  Show description for bed73ff
  jowg-amazon

  authored
  bed73ff